ATOM account privacy notice
Version: public-account-2026-10-17

Publisher and contact
ATOM is published by Austin Peppers as an individual. Privacy and support questions may be sent to Peppera091@gmail.com. Do not send passwords, recovery codes, payment details, license identifiers, repository contents or raw diagnostic files.

Accounts and sign-in
Your account connects sign-in, policy acceptance, billing status and approval of ATOM installations. The website links to the configured account service. Enter your password and saved recovery code only in that service's account forms, never in Codex or another chat.

The account service receives your username and password when you register or sign in. Account storage includes your normalized username, a salted password verifier, a recovery-code digest, policy versions and acceptance times, and account/security metadata. A password is not stored as a password-account field; this does not mean it never enters request-processing memory.

Password sign-in uses a Secure, HttpOnly browser cookie and a server-side session digest. Optional genuine passkeys use public-key credential records. The existing passkey portal also uses browser-tab session storage for its authorization token; optional account linking holds temporary authorization in memory. Password sign-in does not establish passkey verification. Requests also supply network metadata used for authentication and abuse limits.

Changing a password preserves genuine passkeys. Recovery changes the password and saved recovery code, revokes browser credentials and passkeys, and preserves the same account's billing and device grants. These actions do not erase account or billing history.

Payments and installation access
Payment details are entered on Lemon Squeezy's hosted checkout. Checkout links carry signed account and offer references. ATOM verifies provider messages and retains billing/subscription identifiers, normalized facts, digests and provenance used to decide account-bound access. Provider messages can contain additional provider-supplied metadata. ATOM's inspected account forms and persisted billing projection do not define card-number or CVC fields. Lemon Squeezy's separate privacy notice is at https://www.lemonsqueezy.com/privacy.

Device approval links an installation to your account. Licensing processes account, license and device identifiers, version information and signed entitlements. Main account storage retains signed entitlement and activation history. The plugin verifies its signed entitlement locally. The licensing data contract excludes repository contents, source code, prompts, diffs, local coordination receipts and build reports. Signing up, navigating to checkout or returning from checkout does not itself grant paid access.

Storage, recovery and retention
Cloudflare hosts the selected account-service and separate private recovery-custody storage. The custodian receives integrity hashes, counts, monotonic values, target/operation metadata and recovery bookmarks, rather than the underlying account rows. Account rows can also exist in separate platform backups or point-in-time recovery history.

Account, billing and audit history is retained by the current implementation. Selected temporary records are pruned during later operations. Session expiry, sign-out, revocation and the seven-day recovery-eligibility window are not account or backup deletion schedules. There is no automatic account-erasure workflow in the selected implementation. Contact the publisher for privacy or account-data questions; this notice does not promise a deletion deadline or removal from all platform backups. Hosting request/security logs and backup retention are separate from application validity and cleanup rules.

Optional website analytics
Website analytics is separate from account storage and requires opt-in. It records allowlisted public-page/event, coarse referral/device categories and a day-bound hash of a rotating browser identifier. Account routes and account/license/payment fields are excluded from this analytics projection. Global Privacy Control and Do Not Track keep analytics off. Change your choice through Privacy choices on the website.

The analytics reporting window is 30 UTC calendar days. Older rows are deleted on the next accepted event or owner report request. Withdrawing consent stops future collection and clears the daily browser identifier; it does not erase prior events. Provider request/security logs and backups have separate policies. A download click does not prove a download, installation or purchase.